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(54) ILLICIT OPERATION DETECTION METHOD 

(57)Abstract: 

PROBLEM TO BE SOLVED: To detect an illicit rewrite operation to a 
memory in terms of software and to search a task and a processing 
which performed the illicit rewrite operation. 

SOLUTION: In this illicit operation detection method in the kernel of a 
multi-tasking system for executing a control transfer processing to a 
user interruption processing and a task dispatching processing for 
actuating a user task, a preservation means 1c preserves the 
contents of a monitoring object memory space 1a in a preservation 
memory space 1b beforehand, a comparison means 1d checks 
whether or not the memory contents of the monitoring object memory 
space 1a and the memory contents preserved in the memory 1b 
match with each other, as to the start of the user task, the 
processing end of the user task, the start of the user interruption 
processing and the end of user interruption processing, and an illicit 
operation detection means 1e discriminates a memory rewrite illicit 
operation by the user task or the user interruption processing based 
on the change of the memory contents. 
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^C0^ffi^:^^-rSt>(^T-^> f3 , SGSEM IS^^^^^r^ 
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^-O- hiS^O^atR 1 1 e 14, Ufe%S2 i tcR^^nr 
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3) o -ff£t>h, y^TAn-zKc^^n^t/yx^ 
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7 7^) , < = ir 5/ h fj^ h 7) t, K«ffl2 1 
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0) , «J6a-KFNC ( = h77^) , 
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[0 0 3 9 ] h»fEft##«feixtf, jEiifc 

mm%**? i 3K«»u mm%$*$ i 3(7>m^£ 

ffiSM"5 (^77^3 0 4, 3 0 5) c — *\ Tffis* 

1 9 ^3 0 6 , 307) e 1120 

hii*Dte3£«5 lie tt*Jffl*^^^ l 2 (7>^fr$:^ 
&M£i%Z>^ t\zX 9 , *Jffl#tt = >'y-/uS6tt2 OS: 

[0 0 4 0] (c) hJFjEtftf^tttiJ<7>»3ieJS 

*»TLfcn£fc:j; 19 * 0>*#«ffi£rfT 5 IS 3 ^Ifc 
W^SfiRBI^fcSo i^, l l f tts/ 

^^-^a— ^*&3ffias, 1 2f4flJ£?#^;*^, 1 9(4^'< 

s>#* 2 i tt^^^^ h*f¥«w*«=d«Rfi*nsia 

Ifrtcj; i9^i&-r5o ^rir, (l) ^yjEf i 9(4^-^^ 

ttttiifeWSriatttasz 1 tcR^-TSo 7ff 
? h»^7 A3— /ua*, ^M{c^ffi^Tt5 
^Mt5t)^T^S 0 :of:ft, 

[0 0 4 1 ] ^y^lcj:5^^x^ hftfft&tt&tt 
R«3&«»T-*-n(i, *\\m%#*i? 1 2 0MI^|^t 

6 0 tit, (2) mm%**j? i 2^y^x^ htftff 

«3R-*"<5£, (3) *-^;H l(D^7i*3-^M» 

1 1 f ttS3R$nfc^-^V>a:^ hUf^^IftlJlHt 

5. Lt!>>L, htSfE** 



(10) 4#^^9 - 2 2 3 6 9 
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£*(c(4, ^7A3-^»«»Ti:t5. (4) 

[0 0 4 2] ^-^^^ ^ h*flMfcffi&f*tC*3^T , 
^7i,^^Ml^T^- KI4 r^ajgj iiot^ 

50 Z<Dfz#). v'^f^^-yuMi^l 1 f ^7 

- HcB8«fc< , \Ehl^mm%? l 2co^^4d^ 
/^f 2 0 Sr*Jffi irlg^T bfc^^^*gg#jh*!)5 

[0 0 4 3 ] (d) 9 h^jEtftft«a<OjS4, « 

5 Hl^'J 

51 5(4, ^^Lfc^-^v^^^ h*fM**#**TL;fc;i 

t«t s t ^ ^ ^ cons* * *<rr»«»T 
h^as/aj&'H-w h y^ymm^ 1 0) 

^^^(7)M<b^tM^T3-K (3-k=8) £ 
-en^nf5@^5 2 licR^LTj3< 0 W^^M2 
^b^^fAn^/Kc^tj^^fc^^x^ hj£ 

Tt^i^Clj:, -T-<V hil^oM^^ 1 l e 14, v-^x 

fjj^^l43>y-/ugg^fij^Lr^^^T Ufc^^^ 
[0 0 4 4 ] Hi 6(4, fi^Lfc^-^v?*^ hsft^^L 

MSW{c*5t>r, (HIl 4) ^^^-5,^(4. 

h77^/MiF=io) 
UW^^^S^^R^J^T^— K (3— k=7) Sr-en 

fiiEM2 i[c^^iri5< 0 mm#?*? 12^ 

^^7A3"/Kao^^nt^yv>x^ hl&fMc 
^"T6^^^TP#. Y-O- hii^otoSW 1 1 e 14, ftix 
5(? ^fAa^/Hc^ShS^^x^ hoaffl/WSU^F-^ 
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-g\ Y-<^ hia*o*&3S«i 1 1 e 12, =»— /u£r^ 

fT-Sr^&rL, r/<^^^^fijtSo SMS, *Jffl*«t3^ 

y-yugg£#J# ITiMT Lfc^ :* £r^# it 5 
ZtfrX'2 5o 

[0 0 4 5] (D) y 7— ^<z>£# 5^ 

— ;K73££®f£3 1 a — 3 1 c <Drt82fflflL«rfrl\ 
jeaS:^***^**^ K^3 1a' -31c 7 icf 

H9-KtiTMt^o x. T-ix'tyT-xmmzi: 

[0 0 4 6] Hi 8^^^-y /UO££^igctC#-f 6 

4 0 2) 0 iJ?te< t t> 1 o^ffi*«*(C*3t^TADaL»* 
&&M-TZ> (XT y?4 0 3, 4 0 4) 0 *Jffl# 

[0 0 4 7 ] — 77^/4 0 2 CfcV^r, 

If, *>5^Mi. ^fj'^4 0 1l:*5^r. tnoj t-&> 
*uf , ^!)/o .jy^o^Sfl (y ^-^^d^) fc£ 

U7^4 0 5) , Sftir/ittMfflit)!:!^ * 

7^4 0 1ttMI^i^It. £#fgi£ 
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^4 0 6) . KJ!ra»je*«:^#««o**ir K u^tcft 

*ftL (77^4 0 7) , ^(CM*?, Xy-y-f 

ttg-TS^ tic J: !?*IE*#&*»fls&»ffi"r£;:i: <> 
[0 0 4 8 ] 

[0049] wsiaM, y7hmtZ**rV<^<D^ 
^P^<lTp:i:^5o X. ^<om-k. Eta* 

fflts ^ ^ 'J *ft*f u < < ^* &mm\^£.ft 
if, p<*-y 7—j\s<D&$mm<D& o\z.<y<<i-^ <y?\z& 

[ 0 0 5 0 ] fr&mz. , T ^-tr^!»*&^<Oil^(c 
[H 1 ] 1 o/^^RP^gir*^So 

5(7 [S3] frftW&m 3 cD/g3lR^IIlT-£>6o 



21 

[04] **y*jEm&z.»m?4 ^ >y<Dmmmx'h 

[0 5] *Jffl#^^^«cj;5p<^- y o^FjE»»i»ff« 
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